Tagged: Wazuh
28 posts · browse all tags
-
Host-Based Detection Part 9: Alternatives, and Handing Off to the Blue Team
OSSEC, Sysmon, auditd, osquery, Falco, and commercial EDR, compared honestly against Wazuh. Then a straight list of what the next series still has to do, now that a real domain controller and two real managers exist to test it against.
-
Host-Based Detection Part 8: Active Response, or When Wazuh Hits Back
Every other module in this series watches and tells you. Active response acts on its own. What the mechanism actually looks like, and a real lockout story from elsewhere on this site that explains why the timeout matters.
-
Host-Based Detection Part 7: How a Log Line Becomes an Alert
A raw log line becomes an alert in exactly two steps: decode, then match. How Wazuh's default ruleset already covers SSH, PAM, and sudo with zero custom rules, and where a shipped check turned out to be wrong.
-
Host-Based Detection Part 6: File Integrity Monitoring and Rootcheck
FIM, rootcheck, and SCA all answer some version of is this system still what I think it is, and none of them should be trusted blind. What each one actually checks, with real findings from a real run.
-
Host-Based Detection Part 5: Enrolling a Real, Mixed Fleet
A manager with no agents is an expensive way to look at an empty dashboard. What actually happens enrolling a real Raspberry Pi, and separately a genuinely mixed Linux-and-Windows lab fleet, into Wazuh.
-
Host-Based Detection Part 4: Standing Up a Manager, Two Different Ways
Two real Wazuh managers already exist on this site's infrastructure, built for opposite reasons. What the contrast between a shared homelab instance and a disposable lab one actually teaches about sizing and placement.
-
Host-Based Detection Part 3: Agent, Manager, Indexer, Dashboard, and What 5.0 Changes
Agent, manager, indexer, dashboard: how Wazuh's pieces fit together in the 4.14.x line both of this site's real deployments run, and what a still-in-beta 5.0 changes underneath all of it.
-
Host-Based Detection Part 2: From OSSEC to Wazuh, and What Actually Changed
OSSEC didn't stagnate the way it's often described, and Wazuh's 2015 fork happened for specific, checkable reasons. The real history behind the tool already running on two of this site's own boxes.
-
Host-Based Detection Part 1: What a HIDS Sees That a NIDS Never Will
This site has years of network-side detection content and almost none of the host-based half. Starting a nine-part series to fix that, built around two Wazuh deployments that already exist rather than a fresh lab.
-
Metasploit Deep Dive Part 6: CVE-2014-3120, a Real Module, and Three Things Windows Defender Got Right
Running script_mvel_rce against the Elasticsearch 1.1.1 target this series has had waiting since Part 1, why the module never produced a session despite genuine SYSTEM-level RCE, and what checking Wazuh afterward turned up.
-
Metasploit Deep Dive Part 14: Closing the Loop
Thirteen parts of internals, thirteen posts of "here's how the framework works." This one's different: no new commands, just going back through what actually happened in the lab and matching it up against the theory.
-
Metasploit Deep Dive Part 8: Pivoting Into the Blind Spot
Parts 6 and 7 exhausted stock Metasploit against a Defender-protected Windows host with no session to show for it. Part 8 moves to Linux, gets a clean foothold, and pivots into a segment the SIEM can't see at all.
-
Enrichment Has to Come First: Adding IOC Lookups to the n8n Alert Router
Extending the Wazuh-to-chat n8n pipeline with an AbuseIPDB enrichment step ahead of the threshold decision — plus a real, source-level dig into why n8n's workflow static data silently stopped persisting inside the Code node's newer isolated-vm sandbox.
-
Alert Fatigue Is a Routing Problem: A Wazuh-to-Chat Pipeline in n8n
A noisy SIEM is its own security problem — the fix isn't more alerts, it's better routing. Building and testing a Wazuh-to-chat pipeline in n8n, and two real bugs the build itself turned up.
-
Old Kit, New Kit Part 12: The Verdict
All ten pairs, pulled together — the scoreboard, the nine findings that kept recurring across posts, the lab-build lessons that never made a single pair post, and the actual verdict: detection depends on configuration, not on which decade wrote the tool.
-
Old Kit, New Kit Part 11: AD Enumeration, BloodHound and Certipy vs ldapsearch and net
Enumerating a fresh Active Directory domain two ways — ldapsearch and net rpc against bloodhound-python and certipy-ad — including a full ESC1 certificate exploit, and checking what each one actually leaves in Wazuh.
-
Old Kit, New Kit Part 10: Remote Access, evil-winrm vs psexec and Manual RDP
Running psexec, manual RDP, and evil-winrm against the same weak local admin credential on target-win2022, and checking what each one actually leaves in Wazuh.
-
Old Kit, New Kit Part 9: Pivoting — Chisel vs ssh -D / socat
Two classic pivoting options cost wildly different amounts to actually deploy on Windows, chisel gets caught and quarantined by name the moment it touches disk — and the SIEM watching the pivot host misses all of it, including the one thing that actually got caught.
-
Old Kit, New Kit Part 8: Web Screenshotting — Gowitness vs Manual Screenshotting
A real 22x speedup and free structured metadata from gowitness's batch scanning against one-target-at-a-time manual headless screenshots — plus the series' first genuinely quiet, zero-alert pair since Part 4.
-
Old Kit, New Kit Part 7: SMB Enumeration — NetExec vs Enum4linux and Smbclient
NetExec against enum4linux and smbclient for real SMB enumeration on a legacy Samba box and a hardened Windows Server 2022 host — the first Windows-agent Wazuh detection results in the series, and a genuine split decision between the two tools.
-
Old Kit, New Kit Part 6: Vulnerability Scanning — Nuclei vs Nmap's Vulnerability Scripts
Nuclei's active-check templates against nmap's vulners-driven --script vuln, run for real against a lab metasploitable2 box and two Wazuh-monitored targets — plus the richest, most diverse Wazuh alert haul this series has produced yet.
-
Old Kit, New Kit Part 5: Content and Parameter Discovery — Feroxbuster and Ffuf vs Dirb and Gobuster
The first pair in the series with a real, unmissable Wazuh alert footprint — plus a real leaked ops file and a live directory-listing misconfig that only feroxbuster's crawling behaviour actually found.
-
Old Kit, New Kit Part 4: Service and Tech Fingerprinting — Httpx-Toolkit and Naabu vs Nmap -sV and Whatweb
This pair splits down the middle: naabu is 25-30x slower than nmap without root privileges, while httpx-toolkit clearly beats whatweb on speed, detail, and even leaves a quieter log trace doing it.
-
Old Kit, New Kit Part 2: Port and Service Discovery — Rustscan vs Nmap
Rustscan's async port sweep is genuinely near-instant, but the moment a real workflow asks for service versions, it hands straight off to nmap — and that handoff is where the marketed speed advantage quietly disappears.
-
Old Kit, New Kit Part 1: Introduction
Ten classic-vs-modern pentest tool pairs, one real isolated lab, one genuine Wazuh SIEM watching — every run, every timing figure, every log line real. This is the series intro, written last, once there were real findings to introduce.
-
From Dropbox to Daily Driver Part 6: Standing Up a Wazuh Manager, and Why the VM Wouldn't Boot
Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
From Dropbox to Daily Driver Part 9: The Closing Checklist, and What Actually Changed Since Part 5
A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.